0x80070228 Windows Update Error: What It Means and the Fix

If you have already redownloaded this update two or three times, please stop — you are not going to get a better copy, and the failure is not your download. Open Command Prompt as administrator and run these two lines first:

sc config trustedinstaller start= auto
net start trustedinstaller

Here is why, and it reframes the whole error. Decoded, 0x80070228 is ERROR_COULD_NOT_INTERPRET — Win32 error 552 — and its full text reads "the passed ACL did not contain the minimum required information."

An ACL is an access control list. In other words, this is a permissions error. Something in the update process could not get the access it needed to a file or a registry key. It has nothing to do with the download being incomplete or corrupt.

Which means the advice you have almost certainly already followed — delete it, download it again, run the troubleshooter — is aimed at a different problem. A fresh copy of the same update walks into the same locked door. You did the sensible thing; the wording of the error simply pointed everyone in the wrong direction, and it has been doing that for years.

Five Downloads of the Same Update

A customer brought Jake a desktop that had refused the same update for three weeks. She had been methodical about it. She had cleared the download and let Windows fetch it again. She had run the troubleshooter twice. She had found the update in the Microsoft catalog and installed it by hand. She had checked her internet connection, because the error sounded like something arriving damaged.

All of that was reasonable. Every one of those steps is what the error appears to be asking for.

Jake did what she had done, because it is also what he would have done, and got the same code a sixth time. Then he looked up what the number actually decodes to, which took about ninety seconds and changed everything: the word "interpret" in the error has nothing to do with reading a file. It refers to an access control list that Windows could not make sense of.

The update had never been the problem. The permissions on the machine were.

Ethan's take, when Jake told him: "That error is badly worded, and everyone downstream of it repeats the wording instead of the meaning. She spent three weeks doing exactly what the message implied. That's the message's fault, not hers."

Two commands and a DISM run later, the update installed on the first attempt. The thing worth taking from this is not the fix — it is that a diagnostic which sounds like it is about your download is really about your file permissions, and no amount of careful, sensible redownloading was ever going to get past it.

What the Number Actually Says

Windows error codes are not random, and this one is readable if you know how to split it.

Piece	Meaning
0x8007	A standard Win32 error wrapped up as an HRESULT. The interesting part is what follows.
0228	Hexadecimal for 552, the actual Win32 error number.
Error 552	ERROR_COULD_NOT_INTERPRET
Its message	"The passed ACL did not contain the minimum required information."
In plain words	A permissions list was missing something it needed, so the operation was refused.

An access control list is the record attached to every file, folder and registry key saying who is allowed to do what with it. Windows Update leans on those constantly, because installing an update means replacing protected system files, and it is only permitted to do that under very specific permissions.

So when this code appears, the honest translation is: the update process asked to touch something and the permissions on that thing were not in the state Windows required. Nothing about the package. Nothing about your connection. Nothing you typed or clicked wrongly.

The reason this matters practically is that it changes which fixes are even relevant. Anything that deals with the download is beside the point. Anything that deals with who is allowed to write where is on target — and that is what the rest of this page is.

Why the Usual Advice Does Not Land

If you have already worked through a list of steps and none of them helped, here is what each was actually doing. This is not a criticism of the advice — every item is a legitimate fix for a real problem. Just not for this one.

What you were told to do	What it fixes	Why it misses here
Download the update again	A genuinely incomplete or damaged download	The new copy meets the same permission wall as the old one
Run the Update troubleshooter	Stuck services, a confused queue, a damaged cache	It does not repair permissions on files and registry keys
Check your internet connection	Real download failures, which have their own codes	Nothing here happens over the network
Free up disk space	Genuinely full drives, which do break updates	Worth a glance, but a full disk reports itself differently
Install it from the catalog by hand	A broken Windows Update client	Useful as a test — the same failure confirms it is the machine

That last row is genuinely worth doing once, precisely because it is informative either way. If the manual installer fails with the same code, you have proved the fault is local rather than in Windows Update's plumbing, and you can stop investigating that whole branch.

Start With the Service That Does the Installing

Windows does not install updates as you, or even as an administrator. It installs them as TrustedInstaller — the Windows Modules Installer service — which is the only thing on the machine permitted to replace protected system files. When that service cannot run, everything it would have done fails on permissions, which is exactly the shape of this error.

1. Press the Windows key, type cmd, and choose Run as administrator.
2. Allow the service to start: sc config trustedinstaller start= auto. The space goes after the equals sign and not before — start=auto prints a help screen instead, which is easy to scroll past without noticing.
3. Start it: net start trustedinstaller. Read the reply rather than assuming; "started successfully" is what you want.
4. Retry the update.
5. Afterwards, you can return the service to its normal setting with sc config trustedinstaller start= demand. Windows ships it on Manual by design.

If net start reports access denied or an error rather than starting, that is a useful signal in its own right and it has its own page — our guide to the Windows Resource Protection repair-service error covers why that service refuses and how to get it running, including the causes people never suspect.

Repair the Store the Update Installs From

Windows keeps a local component store — the WinSxS folder — holding known-good copies of system files. Updates are applied through it. Damage there, including damage to the permissions on it, produces exactly the family of access failures this error belongs to.

Two commands, in this order, from the same administrator prompt:

DISM /Online /Cleanup-Image /RestoreHealth
sfc /scannow

DISM repairs the store; SFC then repairs individual system files using it. Running SFC first on a damaged store means it has nothing clean to copy from, which is why the order is worth respecting.

Give DISM time. It commonly appears frozen around 20 percent and then finishes normally, and it needs a working internet connection because it pulls replacement files from Windows Update. If DISM itself fails rather than merely taking a while, our full guide to repairing corrupted Windows files with SFC and DISM covers the follow-on cases, including pointing DISM at an install image when it cannot find sources of its own.

One note on the command itself, because it wastes a lot of people's evenings: every slash needs a space before it. /Cleanup-Image /RestoreHealth works, /Cleanup-Image/RestoreHealth returns error 87, and error 87 means you mistyped it rather than anything being wrong with the machine.

Reset the Update Cache

Two folders hold Windows Update's working state, and if the permissions on either have drifted, rebuilding them from scratch clears it. Windows recreates both automatically, so this is safer than it looks.

1. From an administrator prompt, stop the services:

   net stop wuauserv
   net stop cryptSvc
   net stop bits
   net stop msiserver

2. Rename the two folders rather than deleting them, so they can be restored if needed:

   ren C:\Windows\SoftwareDistribution SoftwareDistribution.old
   ren C:\Windows\System32\catroot2 catroot2.old

3. Start the four services again with net start and the same four names.
4. Check for updates. Windows rebuilds both folders and downloads what it needs afresh.

The only thing you lose is the stored update history in some views, which is cosmetic. If a rename is refused, a service is still running — check all four stopped, and restart the machine before trying again if one is stubborn.

The Security Software Angle

Third-party antivirus watches the servicing folders closely, and it is right to. Occasionally that caution goes a step too far and blocks a write the update genuinely needs, which surfaces to you as a permissions failure rather than as a security warning, because from Windows' point of view the write simply was not allowed.

The test is quick: pause real-time protection, retry the update, and turn protection back on immediately either way. If the update installs, add the servicing folders to that product's exclusions or, more simply, pause it during future update installs.

Two honest caveats. Do not leave protection off and forget, which is easier to do than it sounds when the update takes half an hour. And if you only run Microsoft Defender, this is a much less likely cause — Defender is built by the same people as the servicing stack and is not usually in its own way.

Why "Take Ownership" Advice Backfires

Search this error and you will find instructions to take ownership of folders inside C:\Windows, or to grant your account full control of a registry key, sometimes with a ready-made script. It is tempting, it is presented confidently, and it often does clear the error on the day.

It is still worth not doing, and the reason is specific rather than superstitious. Those files are meant to be owned by TrustedInstaller. That ownership is not bureaucracy — it is the mechanism that lets Windows replace system files safely and stops anything else from doing so. Reassigning it to your account means the next update arrives to find the permissions are not what it expects, and fails in a way that is harder to diagnose than the one you started with.

You end up in a worse position than this page found you in: an error that no longer decodes to anything meaningful, on a machine whose permission model has been edited by hand.

Jake asked Ethan why the instructions are so common if they cause trouble later, which is a fair question — they are everywhere. Ethan's answer: "Because they work today and the damage shows up in November. Whoever wrote that guide fixed their own machine, posted it, and never came back to see what happened next month. That's not dishonesty, it's just the shape of the internet. Anything that trades a working system for a working evening looks like a fix right up until it isn't."

DISM and SFC exist to repair permissions to their correct state rather than to override them. That is the slower-sounding route which is genuinely faster, because it leaves the machine able to update itself next month without you.

If you have already taken ownership of something and updates have become stranger since, that is recoverable and you have not ruined anything — an in-place upgrade resets the whole system layer, and it is covered below.

Finding Out Which File Refused

If you want to stop guessing and see the actual point of failure, the servicing log records it. This is less advanced than it sounds — it is a text file, and one command pulls the relevant lines onto your desktop.

findstr /c:"[SR]" %windir%\Logs\CBS\CBS.log >"%userprofile%\Desktop\sfcdetails.txt"

That gives you the System File Checker entries. For the update failure itself, open C:\Windows\Logs\CBS\CBS.log directly and scroll to the timestamp when the update failed. You are looking for lines mentioning access denied, a specific file path, or a registry key — those name the exact place the permission wall is.

You do not need to understand the whole log. One path name is enough to search for, and it turns "updates fail" into "this specific component fails", which is a far easier question for anyone helping you.

The Step That Almost Always Works

If the service starts, DISM and SFC complete cleanly, the cache has been rebuilt and the update still refuses, the practical answer is an in-place upgrade. It sounds drastic and it is not.

Download the Media Creation Tool from Microsoft, run the installer from inside your running Windows — not from a boot USB — and choose to keep personal files and apps. It reinstalls the system layer over the top, which resets permissions, the component store and the servicing stack together, while leaving your programs, settings and documents where they are.

It takes about an hour and it resolves this error in nearly every case that survives the steps above, because it replaces the exact things the error is complaining about.

What it is not is a Reset. Reset removes your installed applications, which is a genuine cost for a problem an in-place upgrade fixes without charging it. If someone tells you to reset the PC for a Windows Update error, the in-place upgrade is the same idea with far less taken from you.

Before you start, take a backup anyway. Not because this is risky — it is one of the safer things Microsoft ships — but because an hour of copying files is cheap insurance and you will feel better doing it.

What This Page Used to Be

This post first went up in March 2017, and it was about this error appearing on one specific Windows 10 Insider build. That was a real problem at the time, and the page helped people who were running that build in that month.

Insider build 15055 is long gone. The error code is not. It still turns up on Windows 11 and Windows 10, on ordinary monthly updates that have nothing to do with preview builds, and the people arriving here now are not Insiders — they are someone whose Tuesday update will not install.

So the page has been re-aimed at the question behind the original one: what 0x80070228 means and what to do about it, on any current version of Windows. The web address is unchanged, so old links still work.

The 2017 version also repeated the standard download-it-again advice, which we now know is aimed at the wrong layer. That is corrected above rather than quietly dropped, because anyone who followed it and got nowhere deserves to know why it did not work.

Your Questions, Answered Straight

What does error 0x80070228 mean?

It decodes to ERROR_COULD_NOT_INTERPRET, Win32 error 552, whose full text is that the passed access control list did not contain the minimum required information. In plain terms it is a permissions error. Something in the update process could not read or write a file or registry key it needed, because the permissions on it are not what Windows expected.

Does 0x80070228 mean my download was corrupt?

No, and this is why redownloading rarely helps. The wording makes it sound like Windows received something it could not read, but the code is about access rights rather than file contents. A fresh copy of the same update hits the same permission wall. That is not a sign you did the download wrong.

What is the first thing to try for 0x80070228?

Make sure the service that installs updates can actually start. Open Command Prompt as administrator and run sc config trustedinstaller start= auto followed by net start trustedinstaller, then retry the update. That service owns the protected files the update needs to replace, and when it cannot run you get permission errors of exactly this shape.

Why does the Windows Update troubleshooter not fix it?

The troubleshooter is good at the problems it knows: stuck services, a damaged download cache, a confused update queue. It does not repair permissions on system files and registry keys, which is where this particular fault lives. Running it is still a sensible first move because it is quick and free, it just often reports nothing wrong.

How do I reset the Windows Update components?

From an administrator prompt, stop the services with net stop wuauserv, net stop cryptSvc, net stop bits and net stop msiserver. Rename the two cache folders by running ren C:\Windows\SoftwareDistribution SoftwareDistribution.old and ren C:\Windows\System32\catroot2 catroot2.old. Then start the four services again. Windows rebuilds both folders automatically.

Is it safe to rename SoftwareDistribution?

Yes. It is a working folder holding downloaded update files and a history database, and Windows rebuilds it on the next check. The only thing you lose is the visible list of past updates in some views, which is cosmetic. Rename rather than delete, so it can be put back if anything unexpected happens.

Should I run SFC and DISM for this error?

Yes, and in that order of thinking: DISM first if SFC struggles. Run DISM /Online /Cleanup-Image /RestoreHealth, let it finish, then run sfc /scannow. Damage in the component store produces permission and access failures during updates, so repairing it addresses the same underlying area this error points at.

Can antivirus software cause 0x80070228?

It can. Security products watch the servicing folders closely, and a few will block a write that the update needs to make, which surfaces as a permissions failure rather than as a security alert. Pausing real-time protection, retrying the update, and turning protection straight back on is a reasonable test that costs a few minutes.

Does this error appear when using DISM offline?

Yes, and there it usually means DISM could not write into the scratch directory or the mounted image. Point it at a folder you know is writable using the /ScratchDir option, run the console as administrator, and make sure the mount folder is on a local NTFS drive rather than a network share or a removable disk.

Do I need to take ownership of files to fix this?

Almost never, and it is worth resisting the advice to do so. Guides that tell you to take ownership of folders inside C:\Windows solve the immediate error by breaking the permission model that Windows relies on, and later updates then fail in stranger ways. Repair the permissions properly with DISM and SFC instead of overriding them.

Will an in-place upgrade fix 0x80070228?

Usually, and it is the right last step rather than a reset. Download the Media Creation Tool, run the installer from inside your running Windows, and choose to keep personal files and apps. It replaces the system layer including permissions and the component store, while leaving your programs and files alone. It takes about an hour.

Is 0x80070228 dangerous or a sign of malware?

By itself, no. It is far more often the residue of an interrupted update, a tune-up script, a permissions change made by an installer, or security software being cautious. Malware can produce permission errors, so a full Defender scan is worth running once, but it is not where the evidence points first.

The update fails but my PC works fine. Do I have to fix this?

You should, but not urgently and not tonight. A machine that cannot install updates is missing security fixes as each month passes, so the gap grows. Work through this page when you have a calm hour rather than treating it as an emergency, because nothing is deteriorating on the machine itself.

How can I see more detail about what failed?

Look at the CBS log. Run findstr /c:"[SR]" %windir%\Logs\CBS\CBS.log >"%userprofile%\Desktop\sfcdetails.txt" for the servicing entries, and open C:\Windows\Logs\CBS\CBS.log itself around the time of the failure. Lines mentioning access denied or a specific file path tell you precisely where the permission wall is.

Can I just install the update manually instead?

You can try, by downloading the standalone package for that KB number from the Microsoft Update Catalog and running it. It sometimes works because it takes a different path to installation. If it fails with the same code, that confirms the problem is on the machine rather than in Windows Update, which is useful information rather than a wasted attempt.

Does this error affect Windows 11 as well as Windows 10?

Yes. The error code is a long-standing Windows one rather than anything specific to a version, and the causes and fixes are the same on Windows 11 and Windows 10. Some Settings screens have moved between versions, but every command on this page works identically on both.

Worth Reading Next

Revision note. Originally published March 21, 2017, about this error on Windows 10 Insider build 15055. Rewritten and re-aimed August 22, 2026 for Windows 11 and Windows 10, at the same web address. That build is long retired, but the error code is not, and almost everyone arriving here now is on an ordinary monthly update rather than a preview build. What changed: the code is decoded properly for the first time — ERROR_COULD_NOT_INTERPRET, Win32 552, a permissions fault rather than a damaged download — and the fixes are ordered around that. The 2017 version repeated the download-it-again advice, which is corrected above rather than quietly removed. If you have spent an evening redownloading the same update, none of that was a waste of your judgment: the error is worded in a way that sends everyone there first, and you were following it exactly as intended.